1. Technical Field of the Invention
This invention pertains to central management of connections in a system. More particularly, it pertains to central management of connections within Virtual Private Networks implementing IPSec and ISAKMP Internet security protocols.
2. Background Art
With the onset of network computing came the need to insure secure connections between networked computers. Usually companies resorted to establishing private networks to do this, and at considerable expense. However, as this trend of Network Computing continues to evolve, it is necessary to extend secure communications with in the enterprise and to utilize the public networks. Driving factors include the need for mobility, company mergers and acquisitions, and the usual xe2x80x9cimproving the bottom linexe2x80x9d. Virtual Private Networks (VPNs), in this context, allow customers to use existing private or public networks, including the Internet, to establish secure connections between other businesses, branch offices, and remote users.
One problem with VPNs is they are usually implemented via proprietary techniques, such that interoperability is limited to single vendor solutions. The IETF now has working groups and draft standards which will allow a more uniform VPN solution across vendors that implement to those standards. IP Security (IPSec) and Internet Security Association Key Management Protocol (ISAKMP) are examples of these standards and these are the standards used in the preferred embodiment of the invention.
Furthermore, the current state of the art establishes IPSec tunnels using these standards, however there is a requirement heretofore not met for providing systems the ability to manage connections established using these standards.
The creation of virtual private networks demands system security on those systems that act as IPSec connection endpoints. Without it, it is not possible to insure that the system isn""t compromised in some way, and that the resulting IPSec tunnel or the VPN connection isn""t compromised. Furthermore, for security reasons and connection manageability reasons, it is desireable the system have a single point of control for all IPSec tunnels and also for VPN connections. This single point of control needs to be able to, programmatically, control connections. The control of the connections include the ability to start and stop manual and dynamic VPN connections. It also needs to delete connections that might have had errors associated with them. For the purposes of interrogating VPN connection status on the system, it needs to provide the ability to query information on these connections. It also needs to manage such things as connection lifetimes, and the refresh of keying material, that is the re-negotiation of dynamic Security Associations (SAs). It should also provide the ability to create VPN connections when this system is acting in a responder role, that is the opposite endpoint of an initiated connection.
It is an object of the invention to provide a system and method for centrally managing connections in a virtual private network.
It is a further objective of the invention to provide a system and method for centrally managing VPN connections with the ability (a) to control access to the resources necessary to start the servers that manage VPN connections, and to control access in the management of those VPN connections; and (b) to start, stop delete and query defined VPN connections on the system, including the ability to discover which connections should be started in a variety of ways.
It is a further object of the invention to provide a system and method for establishing (starting) an active VPN connection in a plurality of ways, including VPN connections using IPSec technologies for protection of IP datagrams.
It is a further object of the invention to limit these VPN connections to a particular lifetime, and to refresh the keying material when VPN policy dictates it is time.
In accordance with the invention, there is provided a system and method for centrally managing connections in a virtual private network. A connection manager is selectively operable for managing, including starting, stopping, deleting, and querying, instantiated connections.